Answer in brief
CVE-2022-32156 records a High severity (CVSS 7.4) vulnerability in Splunk Enterprise and Universal Forwarder CLI connections lacked TLS cert validation. The current sources do not mark it as known exploited. The current feed maps Splunk/Splunk Enterprise (generic), Splunk/Universal Forwarder (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Splunk/Splunk Enterprise (generic), Splunk/Universal Forwarder (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Splunk/Splunk Enterprisegeneric | >=0 <9.0.0 | 9.0.0 |
| Splunk/Universal Forwardergeneric | >=0 <9.0.0 | 9.0.0 |
Published upstream
Jun 14, 2022
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 2, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 2, 2026
In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface (CLI) did not validate TLS certificates while connecting to a remote Splunk platform instance by default. After updating to version 9.0, see Configure TLS host name validation for the Splunk CLI https://docs.splunk.com/Documentation/Splunk/9.0.0/Security/EnableTLSCertHostnameValidation#Configure_TLS_host_name_validation_for_the_Splunk_CLI to enable the remediation. The vulnerability does not affect the Splunk Cloud Platform. At the time of publishing, we have no evidence of exploitation of this vulnerability by external parties. The issue requires conditions beyond the control of a potential bad actor such as a machine-in-the-middle attack. Hence, Splunk rates the complexity of the attack as High.
Quoted source text, attributed separately from HOL analysis.